Privacy Policy: Nordic Calendar

1. Who we are

Nordic Calendar is made by Valorbyte Oy (Business ID 2940641-8), Finland. Valorbyte Oy is the controller of the personal data described in this policy. Contact: antti@valorbyte.com.

We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).

2. In short

• You do not need an account. We do not ask for your name, email address or phone number. When you install the app, it creates a random, anonymous identifier.
• Your calendar events and reminders stay in the calendars on your device (for example iCloud or Google). We never receive them.
• The app's own data, such as tasks and checklists, stays on your device. If you turn on sync, it is end-to-end encrypted on your device before it leaves, and we cannot read it.
• We use usage analytics to improve the app and to see which campaigns bring new users. We do not sell personal data, we do not show ads in the app, and we do not build advertising profiles.

3. What we process and why

3.1 Data that stays on your device

• Calendar events and reminders, if you allow access, to show and edit them in the app.
• The app's own data: tasks, checklists, event templates and series, important marks, family member tags, leave-by reminders, colours and reminder settings.
• Notifications are scheduled on the device by the app itself.
• Location, if you allow it, is used on the device for sunrise and sunset times. For weather, the name of your town and travel times it is sent as described in 3.4 and 3.5.

Your device's own backup (iCloud or Google) may include the app's data, under Apple's or Google's terms.

3.2 Anonymous app identifier and app record

When the app is first opened it signs in anonymously to our backend (Supabase). We store a random user identifier and, linked to it, the app region, platform, operating system and app version, a referral code if you entered one, your subscription status and the purchase service's customer identifier (see 3.6), and the timing of the setup steps. Supabase Auth, which runs the sign-in, also keeps the app's session: the IP address and user agent at the last sign-in or token refresh. The app never signs out, so the session is kept as long as the identifier.

Purpose: to run the app and its subscriptions, to let Pro carry across your synced devices, and for aggregate statistics. Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and our legitimate interest in operating and developing the app (Art. 6(1)(f)).

3.3 Usage analytics and install attribution

We use PostHog (EU cloud) and Google Analytics for Firebase. They receive events about how the app is used (for example which views and features are opened, settings changed and steps in the purchase screen), the anonymous identifier, the app version, the device model, the operating system, the language and region setting, and, derived by the provider from the network connection, an approximate location at country or city level.

If you installed the app from an ad, we record the campaign it came from: on Android, the Google Play install referrer (which can include a Google Ads click identifier and campaign parameters); on iOS, Apple's AdServices attribution (campaign, ad group and keyword identifiers). We do not use the advertising identifier (IDFA) on iOS and do not ask for tracking permission.

On Android, Google Analytics for Firebase also receives the device's advertising ID, which Google uses to measure and attribute ad campaigns. You can reset or delete the advertising ID in the Android settings.

Analytics never include the content of your events, tasks, checklists, notes, places or names, and we do not record screen sessions.

Purpose: to understand how the app is used, fix problems, improve features and measure our marketing. Legal basis: our legitimate interest (Art. 6(1)(f)). You may object at any time by contacting us.

3.4 Weather

When the app shows weather, it sends your location, rounded to about 10 km, to the Norwegian Meteorological Institute's forecast service (api.met.no), which returns the forecast. The request names the app and our contact address, as the service requires. Legal basis: our legitimate interest in providing the feature you use (Art. 6(1)(f)).

3.5 Place search and travel times

When you type a place for an event, the text you type is sent to the platform's map service to find matching places: Apple Maps on iPhone and iPad, and the device's geocoding service (provided by Google) on Android. For leave-by reminders on iPhone and iPad, the start and end coordinates are sent to Apple Maps to calculate the travel time. To show the name of your town for weather and sunrise times, the device's coordinates are sent to the same geocoding service (Apple on iPhone and iPad, Google on Android), and so is the name of a town you search for. These services process the data under Apple's and Google's privacy policies; we do not receive it.

3.6 Purchases

Purchases are handled by the App Store (Apple) or Google Play. We never see your payment details. RevenueCat, our subscription service, receives the anonymous customer identifier, the purchase receipts and your subscription status, so that the app can unlock Pro. Legal basis: performance of a contract (Art. 6(1)(b)).

3.7 Sync between your devices (optional)

Sync is off until you turn it on. It is end-to-end encrypted: the app encrypts your data on your device with a key that only your devices have, so the server stores ciphertext that we cannot read. There is no account and no password.

What the sync server stores:

• the encrypted records, and for each record an opaque identifier derived from your key, the kind of record (such as "tasks"), whether it was deleted, a timestamp and its size;
• for each device in your sync group: its name (encrypted), its platform (iOS, Android or web), when it joined and when it last synced, and its anonymous user identifier;
• for the group: a hash of the code used to join it, its limits and timestamps, and, to check whether the group has Pro, the purchase service customer identifiers of its devices and the date until which the group's Pro is valid;
• for the limits on how often groups are made and joins fail: a record of each group created and each failed join per anonymous user identifier, deleted after 2 days;
• when a device's anonymous user identifier is renewed (for example when the key is restored after a reinstall): a record linking the old identifier to the new one, so that unlock codes, referrals and the referral code move with it; it is kept as long as the old identifier exists.

The key never reaches us. It stays on your devices and in the copies you choose to make: iCloud Keychain on Apple devices (end-to-end encrypted by Apple), Google's Block Store backup on Android, and any recovery link you save. Anyone who has the key or the recovery link can read your synced data, so keep them private.

Retention: the server deletes a sync group and everything in it 180 days after the last sync from any of its phones or tablets (a browser's visits do not count as syncs). If the group's Pro ends, devices of the other platform are removed 180 days later. A one-time move to a new phone is kept until it arrives and at most 7 days.

Deletion: in the app, Settings › Sync › Turn off and delete the server copy deletes the group, its devices and its records from the server immediately. Turning sync off on one device removes only that device, unless it is the group's last phone or tablet: then the group is deleted, with its browsers and records. The data on your devices is not affected either way.

Legal basis: performance of a contract, as you asked for sync (Art. 6(1)(b)).

3.8 Your tasks in a browser (optional, Pro)

With Pro you can pair a web browser, for example on a computer, to see your synced tasks and the family members they are assigned to. The browser joins your sync group as a device of its own, on the platform "web". It only reads: it never sends records, and it cannot remove devices or delete the group.

What the browser keeps, on the computer:

• In its IndexedDB storage: the sync key, which opens all your synced data, the anonymous user identifier it joined with, the date it was paired and the date the page was last opened.
• In its local storage: the anonymous session it uses to reach the sync server. The browser signs in anonymously, like the app (3.2), but only when you choose Show the code on the page or, once paired, when its session was lost, and no app record is made for it.
• Nothing else: each time the page opens, the browser downloads your encrypted records and decrypts in memory only those of your tasks and of your family members and their tags, to show your tasks. Nothing it decrypts is saved, and it is gone when you close the page.

The page that shows your tasks loads no analytics and no third-party scripts.

What the sync server stores for a browser:

• the same as for any device in 3.7: its name (encrypted; the browser and operating system, such as "Firefox on Windows"), its platform (web), when it joined and when it was last seen, and its anonymous user identifier;
• when you choose Show the code: a one-time pairing offer, holding the browser's anonymous user identifier, when the offer was made, last checked, answered and expires, and the app's answer, which is the sync key wrapped so that only that browser can open it. The server cannot open it. The browser's public key travels only in the QR code, never through the server. The offer works for 5 minutes and is deleted when the browser collects the answer, or by the daily clean-up once it has expired;
• for the limit on how many offers a browser can make: a record of each offer per anonymous user identifier, deleted after 2 days;
• in Supabase Auth, which runs the sign-in: the anonymous user identifier, when it was made and last signed in, and a mark that it is a browser's; and the browser's session, with your IP address and the browser's user agent at the last sign-in or refresh. The session is deleted when you sign out on the page, or with the identifier.

The browser downloads the same end-to-end encrypted records as your other devices. Like any web request, the page's requests reveal your IP address to Vercel, which hosts the page, and to Supabase, which runs the sync server.

Retention: the browser stays paired until you sign it out on the page, which removes it from the group and deletes the key and the session from the browser. The server removes a browser that has not been seen for 30 days. If the page has not been opened for 30 days, the browser deletes the key the next time the page opens; the key is also gone when the site's data is cleared in the browser. The server also removes the browsers 180 days after the group's Pro ends, together with the devices of the other platform. You can remove a browser at any time in the app under Settings › Sync. A browser never keeps a sync group alive: when the last phone or tablet leaves the group, the group is deleted with its browsers and records. The browser's anonymous user identifier, with its session and its entries in Supabase Auth's log of sign-ins (which can include the IP address), is deleted once it is in no sync group, has no pairing offer and has not been used for more than 31 days. Supabase also keeps its own request logs, which include IP addresses, for a limited period set by its service.

Legal basis: performance of a contract, as you asked to pair the browser (Art. 6(1)(b)).

3.9 Feedback

If you send feedback in the app, we store the text you write, the reasons you picked, the app version, platform and operating system version, linked to the anonymous identifier. Please do not include personal data you do not want to share. Legal basis: our legitimate interest in answering and improving the app (Art. 6(1)(f)).

3.10 Articles and other content

The app downloads articles and calendar data (such as school holidays) from our website and our backend. Like any web request, these requests reveal your IP address to the hosting provider; they carry no identifier of yours.

4. Service providers

We use the following processors, under data processing agreements:

Some of these providers are based in the United States or process data there. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

We do not sell personal data or share it with anyone else, except where the law requires it.

5. How long we keep data

• Anonymous app record: as long as the app is in use, and deleted on request.
• Analytics: kept for the period set in each analytics service, after which it is deleted.
• Sync and your tasks in a browser: as described in 3.7 and 3.8.
• Feedback: as long as needed to handle it and improve the app.

6. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. To use these rights, email antti@valorbyte.com. Because we do not know who you are, we may ask for details that help us find your data, such as when you installed the app.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where the controller is established.

7. Children

The app is suitable for all ages. We do not knowingly collect personal data from children beyond the anonymous use described above.

8. Security

Data is sent over encrypted connections. Access to our services is restricted, and sync data is end-to-end encrypted as described in 3.7.

9. Our website

Our website (nordiccalendar.app) uses analytics without cookies (Vercel Web Analytics and PostHog in memory only). It does not store cookies for analytics. The page a sync link opens loads no analytics, and the key in the link never leaves your browser. The page that shows your tasks in a browser (3.8) loads no analytics either.

10. Changes to this policy

We may update this policy. The date at the top shows when it last changed. We will tell you about significant changes in the app or in its store listing.

11. Contact

Valorbyte Oy, Finland. antti@valorbyte.com